Disclosure of Social Security Numbers

“(a)(1) It shall be unlawful for any Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his social security account number.

(2) theprovisions of paragraph (1) of this subsection shall not apply with respect to—

(A) any disclosure which is required by Federal statute, or

(B) the disclosure of a social security number to any Federal, State, or local agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual.

(b) Any Federal, State, or local government agency which requests an individual to disclose his social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.” Section 7 of the Privacy Act of 1974, as amended, 5 U.S.C. § 552a note (Disclosure of Social Security Number)).

Comment:

Section 7 was passed into law as part of the Privacy Act of 1974, Public Law 93–579, 88 Stat 1896. Unlike section 3 of the Privacy Act, however, which Congress designated as an amendment to Title V of the United States Code, Congress made no such statement about section 7. Thus, the reviser of the United States Code placed section 7 in a “Historical and Statutory” note following section 552a. See 5 U.S.C. § 552a (note). The fact that section 7 was never codified and appears only in the “Historical and Statutory Notes” section of the United States Code, does not diminish its weight, however: “The reverse is true: ‘the Code cannot prevail over the Statutes at Large when the two are inconsistent.’” Schwier v. Cox, 340 F.3d 1284, 1288 (11th Cir. 2003) (quoting United States v. Welden, 377 U.S. 95 (1964) (internal quotations omitted)). Therefore, section 7 carries the force of law.

To constitute a violation of section 7, an agency must not only request that an individual disclose a social security number, but also deny a “right, benefit, or privilege” to that individual because of the individual’s refusal to disclose the social security number. See, e.g., El-Bey v. N.C. Bd. of Nursing, No. 1:09CV753, 2009 WL 5220166, at *2 (M.D.N.C. Dec. 31, 2009) (dismissing plaintiff’s “Privacy Act/Social Security Act claim” because “Plaintiff alleges only that Defendants requested his number, not that they denied him a legal right based on its non-disclosure so as to potentially violate the Privacy Act”); Johnson v. Fleming, No. 95 Civ. 1891, 1996 WL 502410, at *1, 3-4 (S.D.N.Y. Sept. 4, 1996) (finding no violation of section 7(b) notice requirement or section 7(a)(1) because plaintiff did not establish that police officer denied a “right, benefit, or privilege” when plaintiff refused to provide police officer with his social security number).

Although this provision applies beyond federal agencies, it does not apply to: (1) any disclosure which is required by federal statute; or (2) any disclosure of a social security number to any federal, state, or local agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual. See Sec. 7(a)(2)(A)-(B).

A. Exception for Disclosures Required by Federal Statute

Federal, state, and local agencies may deny an individual a right, benefit, or privilege provided by law because of such individual’s refusal to disclose the individual’s social security number if the disclosure is required by federal statute.

A key statute that requires the disclosure of social security numbers is the Social Security Act (SSA), which expressly permits a state agency to use social security numbers for the purpose of identifying individuals “in the administration of any tax, general public assistance, driver’s license, or motor vehicle registration law within its jurisdiction,” see 42 U.S.C. § 405(c)(2)(C)(i) (2018). The SSA also permits a state agency to use social security numbers to issue birth certificates and to enforce child support orders, the Secretary of Agriculture to use social security numbers in administering the Food and Nutrition Act of 2008, and the Federal Crop Insurance Corporation to use them in administering the Federal Crop Insurance Act. See 42 U.S.C. §§ 405(c)(2)(C)(i), (ii), (iii), (iv).

Several courts have interpreted subsection 7(a)(2)(A) as creating an exception to the general requirement that an individual cannot be denied a benefit for failure to disclose a social security number. See Tankersley v. Almand, 837 F.3d 390, 398-399 (4th Cir. 2016) (holding that the Tax Reform Act, 42 U.S.C. § 405(c)(2)(C)(i), which authorizes states to require an individual “who is or appears to be [affected by the administration of any tax law within its jurisdiction]” to disclose the individual’s social security number, permitted Maryland to compel plaintiff to provide his social security number to the Client Protection Fund of the Bar of Maryland “on pain of suspension of his law license.”); Peterson v. City of Detroit, 76 F. App’x 601, 602 (6th Cir. 2003) (denying applicant’s assertion that city violated Section 7 of Privacy Act when it denied him taxicab license for failure to provide his social security number on grounds that, “insofar as [section 7 of the Privacy Act] relates to the ‘privilege’ at issue in this case [denial of plaintiff’s application], has been superceded by a subsequent amendment to the Social Security Act”); Stoianoff v. Comm’r of the DMV, 12 F. App’x 33, 35 (2d Cir. 2001) (finding that plaintiff’s Privacy Act claim would fail because 42 U.S.C. § 405(c)(2)(C)(i) “expressly authorizes states to require the disclosure of social security numbers in the administration of driver’s license programs” and further provides that “any federal law that conflicts with this section is ‘null, void, and of no effect’”); McElrath v. Califano, 615 F.2d 434, 440 (7th Cir. 1980) (finding disclosure of social security number required by regulation that implements Aid to Families with Dependent Children program do not violate Privacy Act); Green v. Philbrook, 576 F.2d 440, 445-46 (2d Cir. 1978) (finding that disclosure of children’s social security numbers required by state program that provided aid to families with children through federal funds did not violate Privacy Act); Ruiz v. Rhode Island, No. CV 16-507WES, 2020 WL 1989266, at *3 (D.R.I. Apr. 27, 2020) (concluding that state had legitimate reason to request social security number because it was required to comply with Medicare, Medicaid and SCHIP Extension Act); Lanzetta v. Woodmansee, 2013 WL 6498403 at *3 (M.D. Fla. Apr. 15, 2013) (dismissing claim that state tax collector’s office violated Section 7(a)(1) by requiring plaintiff to furnish his social security number in order to renew his motorcycle license on ground that such disclosure was mandated by Real ID Act of 2005); Dejeu v. Wash. State Dep’t of Labor and Indus., No. C13-5401RBL, 2013 WL 5437649, at *1-2 (W.D. Wash. Sept. 27, 2013) (finding that “State’s requirement that Plaintiff disclose his Social Security Number in order to register [with State as a contractor] does not violate the Privacy Act” as “[social security] information is statutorily required”); Rodriguez v. Lambert, No. 12-60844, 2012 WL 4838957, at *3 (S.D. Fla. Oct. 11, 2012) (discussing “Florida statute requiring workers to list their social security number” in relation to Section 7); Claugus v. Roosevelt Island Hous. Mgmt. Corp., No. 96CIV8155, 1999 WL 258275, at *4 (S.D.N.Y. Apr. 29, 1999) (considering housing management corporation to be state actor for Privacy Act purposes but finding that Privacy Act does not apply to income verification process for public housing program because of exception created by 42 U.S.C. § 405(c)(2)(C)(i)); In re Turner, 193 B.R. 548, 552-53 (Bankr. N.D. Cal. 1996) (holding that the Bankruptcy Code, 11 U.S.C. § 110(c) (2006), required disclosure of social security number, thus section 7(a) inapplicable; further holding that section 7(b) also was inapplicable “even assuming the [U.S. Trustee] or the clerk of the bankruptcy court were agencies” because no “request” had been made, and the notice requirements therefore not triggered; rather, because disclosure of social security number is required by statute, “the [U.S. Trustee] is enforcing a Congressional directive, not ‘requesting’ anyone’s SSN” and “[t]he clerk receives documents for filing but does not police their content or form or request that certain information be included”); In re Rausch, 197 B.R. 109, 120 (Bankr. D. Nev. 1996) (holding that the Privacy Act “inapplicable” because 11 U.S.C. § 110 “requires placing the SSN upon ‘documents for filing’”).

B. Exception for Laws and Regulations in Effect Before January 1, 1975

A second exception to the general provisions of section 7 is set out in subsection 7(a)(2)(B), which grandfathers statutes or regulations in effect before January 1, 1975, and provides that the prohibition on denying a benefit because of an individual’s failure to provide a social security number does not apply to those statutes and regulations. See Schwier v. Cox, 439 F.3d 1285, 1285-86 (11th Cir. 2006) (holding that section 7(a)(2)(B) grandfather exception did not apply to Georgia voter registration procedures), aff’g 412 F. Supp. 2d 1266 (N.D. Ga. 2005), remanded by 340 F.3d at 1288-89 (explaining that although section 7 is uncodified, it is still present in the Statutes at Large and therefore is not “a dead letter”); McKay v. Thompson, 226 F.3d 752, 755 (6th Cir. 2000) (finding that Tennessee law requiring disclosure of social security number for voter registration fell within section 7(a)(2)’s exception for systems of records in existence prior to January 1, 1975, where disclosure was required under statute or regulation).

C. Federal, State, and Local Government Notice Requirements

Subsection 7(b) specifies the notice that Federal, State, and local agencies are required to give when requesting individuals’ social security numbers.

Pursuant to subsection 7(b), an agency that requests that individuals disclose their social security numbers must notify individuals whether the disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it. See Crawford v. U.S. Trustee, 194 F.3d 954, 961-62 (9th Cir. 1999) (rejecting government’s argument that because disclosure of plaintiff’s social security number was expressly required by federal statute, section 7 was wholly inapplicable, stating that “§ 7(a)(2)(A)’s exclusion for federal statutes only pertains to the limitation recited in § 7(a)(1),” and holding that section 7(b) notice requirements had “no bearing on the public disclosure of [plaintiff’s] social security number[] by the government,” which was only issue in dispute); Alcaraz v. Block, 746 F.2d 593, 608-09 (9th Cir. 1984) (finding section 7(b)’s notice provision satisfied where agency informed “participants of the voluntariness of the disclosure, the source of authority for it and the possible uses to which the disclosed numbers may be put”); GeorgiaCarry.org, Inc. v. Metro. Atlanta Rapid Transit Auth., No. 1:09-CV-594, 2009 WL 5033444, at*9-10 (N.D. Ga. Dec. 14, 2009) (finding “one or both of the [transit authority police] officer Defendants violated section 7(b)” when officers “asked [plaintiff] for his identification, firearms license, and social security number . . . . But neither officer told [plaintiff] whether he had to provide his social security number, what authority they relied on in asking for the number, or what the number would be used for”); Szymecki, 2008 WL 4223620, at *9 (concluding that plaintiff stated claim under section 7 where he alleged that city threatened to arrest and incarcerate him if he did not provide his social security number and that city did not inform him why it needed number or how it would be used); Russell v. Bd. of Plumbing Exam’rs, 74 F. Supp. 2d 339, 347 (S.D.N.Y. 1999) (finding violation of section 7 and ordering injunctive relief where defendants neither informed applicants that providing social security number was optional nor provided statutory authority by which number was solicited, and no statutory authority existed); Greidinger v. Davis, 782 F. Supp. 1106, 1108-09 (E.D. Va. 1992) (finding violation of the Privacy Act where state did not provide timely notice in accordance with section 7(b) when collecting social security number for voter registration), rev’d & remanded on other grounds, 988 F.2d 1344 (4th Cir. 1993); Oakes v. IRS, No. 86-2804, 1987 WL 10227, at *1 (D.D.C. Apr. 16, 1987) (finding that agency requesting individual to disclose his social security number was required to inform individual in accordance with section 7(b) but was not required to publish notice in Federal Register); Doyle v. Wilson, 529 F. Supp. 1343, 1348-50 (D. Del. 1982) (finding section 7(b)’s requirements are not fulfilled when no affirmative effort is made to disclose information required under 7(b) “at or before the time the number is requested”); Doe v. Sharp, 491 F. Supp. 346, 347-50 (D. Mass. 1980) (following Green and McElrath regarding section 7(a); finding section 7(b) creates affirmative duty for agencies to inform applicant of uses to be made of social security numbers – “after-the-fact explanations” not sufficient); and Chambers v. Klein, 419 F. Supp. 569, 580 (D.N.J. 1976) (following Green, McElrath, and Doe v. Sharp regarding section 7(a); finding section 7(b) not violated where agency failed to notify applicants of for social security numbers because state had not begun using them pending full implementation of statute requiring their disclosure), aff’d, 564 F.2d 89 (3d Cir. 1977) (unpublished table decision). Cf. Gonzalez, 671 F.3d at 663-64 (concluding that qualified immunity shielded police officers from liability where officers had “asked [plaintiff] for his social security number” but “did not give him the information listed in § 7(b),” as “the officers’ obligation to make the disclosures specified in § 7(b) was not clearly established” at time of plaintiff’s arrest); Doe v. Herman, No. 297CV00043, 1999 WL 1000212, at *9 (W.D. Va. Oct. 29, 1999) (magistrate’s recommendation) (citing Doe v. Sharp and subsection (e)(3) for proposition that “when an agency solicits a social security number it shall inform the individual of what use will be made of it”), adopted in pertinent part & rev’d in other part, (W.D. Va. July 24, 2000), aff’d in part, rev’d in part, & remanded, on other grounds sub nom. Doe v. Chao, 306 F.3d 170 (4th Cir. 2002), aff’d, 540 U.S. 615 (2004).

D. Causes of Action

Courts have split over whether section 7 provides a cause of action against agencies and, if it does, whether that action is limited to federal agencies.

Jurisdiction to enforce the social security number provision might appear questionable inasmuch as the Privacy Act does not expressly provide for a civil remedy against a nonfederal agency, or for injunctive relief outside of the access and amendment contexts. Courts of appeals in the Sixth and Ninth Circuit have held that section 7 of the Privacy Act applies exclusively to federal agencies and does not provide for causes of action against state and local entities. See Schmitt v. City of Detroit, 395 F.3d 327, 330-31 (6th Cir. 2005) (noting that it was “confronted by two provisions of the Privacy Act that contradict one another to some degree: the statutory definition, which unambiguously contemplates that the Privacy Act applies exclusively to federal agencies, and § 7(b), which by its terms includes state and local agencies within its ambit,” but after looking to legislative history, ultimately holding that Privacy Act applies only to federal agencies); Dittman v. Cal., 191 F.3d 1020, 1026 (9th Cir. 1999) (holding that Privacy Act provides no cause of action against a state licensing entity inasmuch as the private right of civil action created by subsection (g) “is specifically limited to actions against agencies of the United States Government”); Peterson v. Michigan, No. 11-12153, 2011 WL 3516030, at *1 (E.D. Mich. Aug. 11, 2011) (denying plaintiff’s motion to reconsider on grounds that § 7 does not apply to the State of Michigan); Dionicio v. Allison, No. 3:09-cv-00575, 2010 WL 3893816, at *18 (M.D. Tenn. Sept. 30, 2010) (citing Schmitt and granting summary judgment to defendants, agents of the Tennessee Alcohol & Beverage Commission who were sued in their individual and official capacities on grounds that “the civil remedies established by 5 U.S.C. § 552a(g) for violations of the Privacy Act of 1974 extend only to violations by federal agencies”); Treesh v. Cardaris, No. 2:10-CV-437, 2010 WL 3603553, at *3 (S.D. Ohio Sept. 9, 2010) (also citing Schmitt and finding that while the Privacy Act permits an individual to bring a civil action for disclosure of a social security number, that action may only be brought against a federal agency); Warner v. Twp. of S. Harrison, Civ. No. 09-6095, 2010 WL 3001969, at *4 (D.N.J. July 26, 2010) (dismissing plaintiff’s section 7(b) claim against Township because “Plaintiff’s real complaint is Defendants’ widespread, and apparently unjustifiable, dissemination of his social security number to the public . . . [which is] not covered by Section 7(b), but instead by Section 3. . . . Section 3, however, does not apply to state and local agencies.”); but see Lawson v. Shelby Cnty., Tenn., 211 F.3d 331, 335 (6th Cir. 2000) (holding that “Congress never expressly abrogated state sovereign immunity under the Privacy Act”; however, permitting plaintiffs’ request for prospective injunctive relief [to enforce section 7 of the Privacy Act] against [state] officials” under Ex Parte Young, 209 U.S. 123 (1908)).

Other courts, including the Seventh and Eleventh Circuit Courts of Appeals, have reached the opposite conclusion, however, and have held that the remedial scheme of section 3 of the Privacy Act, which applies strictly to federal agencies, does not apply to section 7, which by its express terms applies to federal, state, and local agencies. See Schwier v. Cox, 340 F.3d 1284, 1292 (11th Cir. 2003); see also Gonzalez v. Vill. of W. Milwaukee, 671 F.3d 649, 661-63 (7th Cir. 2012). In Schwier, the court concluded that “Congress created an ‘unambiguously conferred right’ in section 7 of the Privacy Act,” and it reasoned that section 7 may be enforced under 42 U.S.C. § 1983, which “provides a private right of action whenever an individual has been deprived of any constitutional or statutory federal right under color of state law” as “the remedial scheme of section 3 provides no basis for concluding that Congress intended to preclude private remedies under § 1983 for violations of section 7.” Schwier, 340 F.3d at 1289-90, 1292. Following the Eleventh Circuit’s reasoning in Schwier, the Seventh Circuit in Gonzalez found “no conflict between §§ 3 and 7 [of the Privacy Act]” as “it seems clear that when § 3(a)(1) defines agencies as federal agencies ‘for purposes of this section,’ it refers only to § 3 . . . . Accordingly, there is no need to look beyond the unambiguous text of § 7 to determine its applicability. By its express terms, § 7 applies to federal, state, and local agencies.” Gonzalez, 671 F.3d at 662. See also Lanzetta v. Woodmansee, No. 2:13-cv-276, 2013 WL 1610508, at *2 (following Schwier and stating “[a]n individual may also pursue enforcement of his privacy rights under Section 7 of the Privacy Act pursuant to [42 U.S.C. § 1983]; Ingerman v. Del. River Port Auth., 630 F. Supp. 2d 426, 445 (D.N.J. 2009) (ruling that Delaware River Port Authority’s requirement that social security number had to be submitted to receive a senior citizen “E-Z Pass” violated section 7, which was enforceable under Ex Parte Young); Szymecki v. Norfolk, No. 2:08cv142, 2008 WL 4223620, at *9 (E.D. Va. Sept. 11, 2008) (concluding that “because Section 7 confers a legal right on individuals and because Congress did not specifically foreclose a remedy under [42 U.S.C.] § 1983 for violations of Section 7 . . . violations of Section 7 are enforceable under § 1983”); Stollenwerk v. Miller, No. 04-5510, 2006 WL 463393, at *3-7 (E.D. Pa. Feb. 24, 2006) (concluding that state statute requiring submission of social security number to purchase a handgun was invalid, as section 7 is enforceable under 42 U.S.C. § 1983); Libertarian Party v. Ehrler, 776 F. Supp. 1200, 1209 (E.D. Ky. 1991) (requiring that voter include social security number on signature petition violates Privacy Act); cf. Lawson v. Shelby Cnty., Tenn., 211 F.3d at 335 (permitting plaintiffs’ request for prospective injunctive relief [to enforce section 7 of the Privacy Act] against [state] officials” under Ex Parte Young, 209 U.S. 123 (1908)); Greidinger v. Almand, 30 F. Supp. 3d 413, 426-27 (D. Md. 2014) (noting that private right of action has been recognized in certain circumstances even though question of whether “an individual has an implied private right of action under 42 U.S.C. § 1983 for the violation of section 7 of the Federal Privacy Act is an open question in the Fourth Circuit”) (citing White v. Cain, 2:10-CV-01182, 2011 WL 1087489, at *7 (S.D. W. Va. Mar. 21, 2011)). Contra Treesh, 2010 WL 3603553, at *3 (“[E]ven if disclosure of plaintiff’s medical information somehow violated the Privacy Act, [plaintiff] still fails to state a federal claim” because “section 1983 cannot be used to redress violations of the Privacy Act.”); Bush v. Lancaster Bureau of Police, No. 07-3172, 2008 WL 3930290, at *7-8 (E.D. Pa. Aug. 28, 2008) (concluding that “Plaintiff cannot state a claim under [42 U.S.C. § 1983] for a violation of subsection (b) of section 7 of the Privacy Act” because “[u]pon review of th[e] statutory language, the court cannot conclude that Congress created an ‘unambiguously conferred right’” for individuals).

Other courts also have recognized implied remedies for alleged violations of section 7. See Ky. Rest. Concepts, Inc. v. City of Louisville, Jefferson Cnty. Ky., 209 F. Supp. 2d 672, 687 (W.D. Ky. 2002) (recognizing disagreement but finding that municipality may request social security numbers in adult entertainment applications as part of its regulatory scheme, but also finding that city did not offer any argument that regulation met any of exceptions to enforcement of Privacy Act); McKay v. Altobello, No. 96-3458, 1997 WL 266717, at *1-3, 5 (E.D. La. May 16, 1997) (finding that Commissioner of elections could not require social security numbers from prospective voters as prerequisite to vote because state law did not specifically mention them among items that would sufficiently establish identity); Yeager v. Hackensack Water Co., 615 F. Supp. 1087, 1090-92 (D.N.J. 1985) (concluding that section 7(b) creates implied right of action, in this case against private company whose actions were imputed to state, that “[i]n the absence of a cause of action to enforce section 7(b) in the federal courts, said action would provide an empty right with no means of enforcement. Such would clearly frustrate the intent of Congress.”) (citing Greater Cleveland Welfare Rights Org. v. Bauer, 462 F. Supp. 1313, 1319-20 (N.D. Ohio 1978); Wolman v. United States, 501 F. Supp. 310, 311 (D.D.C. 1980) (finding reliance on Section 3 of the Privacy Act to prevent court from exercising injunctive power misplaced and that “traditional equity powers of the Court must be exercised in these circumstances in the absence of any indication from Congress of an intention to limit the Court’s inherent power to enforce the law”), remanded, 675 F.2d 1341 (D.C. Cir. 1982) (unpublished table decision), on remand, 542 F. Supp. 84, 85-86 (D.D.C. 1982); Greater Cleveland Welfare Rights Org. v. Bauer, 462 F. Supp. 1313, 1320-21 (N.D. Ohio 1978) (concluding “that Section 7(b) affords plaintiffs an implied right of action for prospective relief”).

Section 7 does not provide for a civil remedy against individuals or private entities. White, No. 2:10-cv-01182, 2011 WL 1087489, at *6-7 (dismissing claim brought against police officer alleging that officer violated section 7 by “requesting the plaintiff’s Social Security Number without providing the plaintiff with adequate information” on ground that “the Privacy Act is not applicable to individuals”); Krebs v. Rutgers, 797 F. Supp. 1246, 1256 (D.N.J. 1992) (finding Rutgers is not a state agency or government-controlled corporation subject to Privacy Act and could not distribute class rosters that listed students by name and social security number).

Next Section: Government Contractors

Updated October 11, 2022